GHSA-9mg4-v392-8j68

erlang-jose vulnerable to denial of service via large p2c value

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-50966

Packages

Ecosystem	Package	Affected	Fixed in
Hex	jose	< 1.11.7	1.11.7

Details

As written in the advisory (Markdown source, shown as plain text).

erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-50966 advisory
https://github.com/potatosalad/erlang-jose/commit/718d213f07b08056737923f8063d5df56dcb66ae web
https://github.com/P3ngu1nW/CVE_Request/blob/main/erlang-jose.md web
https://github.com/potatosalad/erlang-jose package
https://hexdocs.pm/jose/JOSE.html web